Make react/http an optional dependency

[jpkalus]

Why

react/http is a hard requirement of this package, but only two classes use it: HttpServerTransport and StreamableHttpServerTransport. Everyone else pays for it — stdio users, and framework integrations that drive Server / Protocol / Dispatcher themselves and do their own HTTP.

The cost is more than a few unused packages. react/http requires psr/http-message: ^1.0, and every release of it does — v1.0.0 through v1.11.1, no exceptions. So php-mcp/server transitively pins its host project's PSR-7 interfaces to 1.x.

That is a hard blocker downstream rather than a theoretical one. Contao 5.7/6 installs psr/http-message 2.0, so on such a project:

• a fresh install silently resolves psr/http-message down to 1.1, and
• an existing install whose lock holds 2.0 cannot update at all — Composer refuses.

I maintain an MCP server for Contao built on this package. My workaround has been "replace": { "react/http": "*" } in my own manifest: a claim to Composer that I ship react/http myself, which I do not. It works, and it has a nasty edge — any other package in the project that legitimately requires react/http is told the need is met, receives no files, and dies at runtime. I would like to stop telling Composer that lie.

What this changes

• react/http moves from require to suggest, and into require-dev so this repository's own suite is unaffected.

• psr/http-message becomes a declared dependency at ^1.0 || ^2.0. src/Context.php type-hints Psr\Http\Message\ServerRequestInterface and is not transport-specific, so this dependency already exists — it is simply undeclared today and reaches the tree only through react/http, which is also what narrows it to 1.x.

• Both HTTP transports fail with a clear message instead of a bare "Class not found":

  react/http is not installed. It is an optional dependency, required only by the HTTP transports. Install it with "composer require react/http".

• README: one line in Requirements, one block in Installation.

Effect on the dependency tree

	before	after (without react/http)
react/http, react/socket, react/dns, react/cache, evenement	installed	not installed
psr/http-message	1.x, transitive and undeclared	2.0, declared as ^1.0 || ^2.0

Installing react/http restores the previous tree exactly; nothing about the transports changes.

Verification

• vendor/bin/pest on this branch and on an unmodified main, same container, same PHP: identical results — 480 passed, 65 failed, and a diff of the two failure lists comes back empty. The 65 are the integration tests that spawn child processes, which my container cannot host; tests/Unit is 449/449 either way. Your CI is the authority on those, not me.
• A separate install with no react/http at all, to check the change actually delivers what it promises:
  • psr/http-message resolves to 2.0
  • Server::make()->build(), discover() and a tools/call through the Dispatcher all work
  • constructing StreamableHttpServerTransport throws TransportException with the message above

Note on scope

Happy to drop the psr/http-message declaration or the transport guards if you would rather keep this to the one-line composer.json move — the manifest change is the part that matters. I kept them in because the first makes an existing implicit dependency honest, and the second is what turns "optional" into something a user can diagnose.

---

🤖 Generated with Claude Code